hivekit 0.8.2__tar.gz → 0.9.0__tar.gz

{hivekit-0.8.2 → hivekit-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hivekit
-Version: 0.8.2
+Version: 0.9.0
 Summary: Toolkits for using hive agents, including CLI and SDK.
 License: 
                                          Apache License

{hivekit-0.8.2 → hivekit-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hivekit"
-version = "0.8.2"
+version = "0.9.0"
 description = "Toolkits for using hive agents, including CLI and SDK."
 readme = "README.md"
 requires-python = ">=3.12"

{hivekit-0.8.2 → hivekit-0.9.0}/src/cli/config.py

@@ -30,12 +30,30 @@ class BaseModel(pydantic.BaseModel):
     model_config = ConfigDict(extra="forbid", coerce_numbers_to_str=True)
 
 
-# Kubernetes caps DNS labels and label values at 63 bytes. The operator derives
-# object names/labels by appending suffixes to the experiment name (the longest
-# is "-coordinator"), so reserve that headroom to keep the derived names valid.
+# Pods created by a Job or Deployment are named "<prefix><5 random chars>".
+# Our pod prefixes are:
+#   coordinator: "<name>-coordinator-"
+#   sandbox:     "<name>-sandbox-<rs-hash>-"
+#
+# The AWS network policy agent identifies a pod by its name minus the last
+# '-' segment. If the coordinator and sandbox pods end up with the same
+# identity, the coordinator will inherit the sandbox's internet-only
+# egress policy (so it cannot reach any in-cluster service, like the database).
+# Reserving room for "-coordinator-", the longer of the two, keeps every pod's
+# role intact.
+#
+# For example, a 51-char <name> leaves only 7 chars for the role:
+#   coordinator: "<name>-coordi" + "6sftc"  -> identity "<name>"
+#   sandbox:     "<name>-sandbo" + "4nxt7"  -> identity "<name>"  (same, broken)
+# while a 45-char <name> keeps both roles:
+#   coordinator: "<name>-coordinator-" + "abcde"  -> identity "<name>-coordinator"
+#   sandbox:     "<name>-sandbox-69df" + "abcde"  -> identity "<name>-sandbox"
 K8S_LABEL_MAX_LENGTH = 63
-RESERVED_NAME_SUFFIX_LENGTH = len("-coordinator")
-MAX_EXPERIMENT_NAME_LENGTH = K8S_LABEL_MAX_LENGTH - RESERVED_NAME_SUFFIX_LENGTH
+K8S_GENERATED_NAME_SUFFIX_LENGTH = 5
+RESERVED_NAME_SUFFIX_LENGTH = len("-coordinator-")
+MAX_EXPERIMENT_NAME_LENGTH = (
+    K8S_LABEL_MAX_LENGTH - K8S_GENERATED_NAME_SUFFIX_LENGTH - RESERVED_NAME_SUFFIX_LENGTH
+)
 # A name ending in '-' gets a random uniqueness suffix appended (see
 # unique_suffix), which eats into the budget the user actually controls (their
 # typed base name).
@@ -77,11 +95,14 @@ KNOWN_MODELS = frozenset(
         "anthropic.claude-opus-4-7",
         "anthropic.claude-opus-4-8",
         "anthropic.claude-opus-5",
+        "anthropic.claude-opus-5-5",
         "anthropic.claude-sonnet-4-6",
         "anthropic.claude-sonnet-5",
         "moonshotai.kimi-k2.5",
         "nvidia.nemotron-super-3-120b",
         "openai.gpt-6-astra",
+        "openai.gpt-6-luna",
+        "openai.gpt-6-sol",
         "openai.gpt-5.6-luna",
         "openai.gpt-5.6-sol",
         "openai.gpt-5.6-terra",
@@ -244,10 +265,6 @@ class SandboxConfig(BaseModel):
 
 
 class PromptConfig(BaseModel):
-    enable_evolution: bool = Field(
-        default=False,
-        description="Whether to enable evolution for the experiment. Default to False.",
-    )
     context: Optional[str] = Field(
         default=None,
         description="Some useful experiment-specific context to provide to the Hive.",
@@ -266,6 +283,20 @@ class PromptConfig(BaseModel):
         ),
     )
 
+    @model_validator(mode="before")
+    @classmethod
+    def drop_enable_evolution(cls, values):
+        """Accept and ignore the removed enable_evolution field without mutating the input."""
+        if not isinstance(values, dict) or "enable_evolution" not in values:
+            return values
+        values = dict(values)
+        values.pop("enable_evolution")
+        logger.warning(
+            "prompt.enable_evolution is deprecated and has no effect. "
+            "Remove it from your config to silence this warning."
+        )
+        return values
+
     @model_validator(mode="before")
     @classmethod
     def migrate_arxiv_ids(cls, values):
@@ -513,6 +544,42 @@ class ProviderConfig(BaseModel):
         "non-interruptible capacity only. Unset (the default): no constraint, "
         "the cheapest available capacity is used.",
     )
+    regions: Optional[list[str]] = Field(
+        default=None,
+        description="The regions the sandbox may be placed in: us, or all for "
+        "every region the platform offers, given as a single value or a list. "
+        "Unset (the default): your default regions.",
+    )
+
+    @field_validator("regions", mode="before")
+    @classmethod
+    def wrap_single_region(cls, v):
+        # `regions: all` or `regions: us` reads better than a one-item list.
+        if isinstance(v, str):
+            return [v]
+        return v
+
+    @field_validator("regions")
+    @classmethod
+    def validate_regions(cls, v):
+        # Only the format is checked here; which regions exist is up to the
+        # backend, so the list can grow without a CLI release.
+        if v is None:
+            return v
+        if not v:
+            raise ValueError("regions must not be empty; omit it to allow any region")
+        regions = []
+        for region in v:
+            region = region.strip().lower()
+            if not re.fullmatch(r"[a-z0-9_-]+", region):
+                raise ValueError(
+                    f"invalid region '{region}', must contain only letters, digits, '-' and '_'"
+                )
+            # The backend treats regions as a set, so drop repeats rather than
+            # have it reject them.
+            if region not in regions:
+                regions.append(region)
+        return regions
 
 
 class AgentModelConfig(BaseModel):

{hivekit-0.8.2 → hivekit-0.9.0}/src/cli/experiment.py

@@ -114,6 +114,8 @@ def build_experiment_crd(config: HiveConfig) -> Dict[str, Any]:
             provider["name"] = config.provider.name
         if config.provider.spot is not None:
             provider["spot"] = config.provider.spot
+        if config.provider.regions:
+            provider["regions"] = config.provider.regions
         if provider:
             experiment["spec"]["provider"] = provider
 
@@ -124,8 +126,6 @@ def build_experiment_crd(config: HiveConfig) -> Dict[str, Any]:
             experiment["spec"]["prompt"]["context"] = config.prompt.context
         if config.prompt.ideas:
             experiment["spec"]["prompt"]["ideas"] = config.prompt.ideas
-        if config.prompt.enable_evolution:
-            experiment["spec"]["prompt"]["enableEvolution"] = config.prompt.enable_evolution
 
     # Add optional agent selection
     if config.agents:

hivekit-0.9.0/src/cli/experiment_download.py

@@ -0,0 +1,131 @@
+# Copyright (C) 2026 Hiverge
+#
+# SPDX-License-Identifier: Apache-2.0
+
+"""Choose export destinations and save complete, validated downloads using bounded memory."""
+
+import gzip
+import os
+import tempfile
+from dataclasses import dataclass
+from email.message import Message
+from pathlib import Path
+
+import requests
+
+from cli.http_client import DOWNLOAD_SYSTEM_ERROR, DownloadError
+
+_CHUNK_SIZE = 1 << 16
+
+
+def resolve_download_output(
+    output: str | None, *, directory_only: bool = False
+) -> tuple[Path, str | None]:
+    """Return the destination directory and optional filename override."""
+    if output is None:
+        return Path.cwd(), None
+    if not output:
+        raise DownloadError("--output must name a file or directory.")
+    path = Path(output)
+    if path.is_dir():
+        return path, None
+    if output.endswith(("/", os.sep)):
+        if path.exists():
+            raise DownloadError(f"Output is not a directory: {path}")
+        path.mkdir(parents=True, exist_ok=True)
+        return path, None
+    if directory_only:
+        raise DownloadError("Full Export requires a directory. Use -o 'DIRECTORY/'.")
+    if output.replace("\\", "/").rsplit("/", 1)[-1] in {".", ".."}:
+        raise DownloadError("--output must name a file or directory.")
+    _check_destination(path)
+    return path.parent, path.name
+
+
+def _check_distinct(main: Path, reports: Path) -> None:
+    resolved_main, resolved_reports = main.resolve(), reports.resolve()
+    same = resolved_main == resolved_reports or (
+        main.exists() and reports.exists() and main.samefile(reports)
+    )
+    if same:
+        raise DownloadError("The main output and evolution reports must have different filenames.")
+
+
+def _check_destination(destination: Path) -> None:
+    if destination.is_dir():
+        raise DownloadError(f"Output is a directory: {destination}")
+    if not destination.parent.is_dir():
+        raise DownloadError(f"Output directory does not exist: {destination.parent}")
+
+
+def _response_filename(response: requests.Response) -> str:
+    disposition = Message()
+    disposition["Content-Disposition"] = response.headers.get("Content-Disposition", "")
+    filename = disposition.get_filename()
+    # AlphaTrion owns sanitization. Reject malformed filenames rather than altering them.
+    if (
+        not filename
+        or filename in {".", ".."}
+        or "/" in filename
+        or "\\" in filename
+        or any(ord(char) < 32 or ord(char) == 127 for char in filename)
+    ):
+        raise DownloadError(DOWNLOAD_SYSTEM_ERROR)
+    return filename
+
+
+@dataclass
+class ExportOutput:
+    directory: Path
+    output: str | None
+
+    @classmethod
+    def prepare(cls, name: str, full_export: bool, output: str | None) -> "ExportOutput":
+        """Validate the output path before authentication or download."""
+        if not name:
+            raise DownloadError("Experiment name must be non-empty.")
+        directory, filename = resolve_download_output(output, directory_only=full_export)
+        return cls(directory, filename)
+
+    def destination(self, response: requests.Response, *, source: Path | None = None) -> Path:
+        """Honor server filenames and check actual destinations before consuming bytes."""
+        filename = _response_filename(response)
+        destination = self.directory / (self.output if source is None and self.output else filename)
+        _check_destination(destination)
+        if source is not None:
+            _check_distinct(source, destination)
+        return destination
+
+
+def save_export(
+    response: requests.Response, destination: Path, *, suppress_empty: bool = False
+) -> bool:
+    """Publish only a complete gzip file; return False for suppressed empty reports.
+
+    The caller owns the response context. Temporary output lives beside the
+    destination so replacement cannot cross filesystem boundaries.
+    """
+    temporary: Path | None = None
+    try:
+        with tempfile.NamedTemporaryFile(
+            mode="wb", dir=destination.parent, prefix=".hive-export-", suffix=".tmp", delete=False
+        ) as output:
+            temporary = Path(output.name)
+            # Preserve AlphaTrion's compressed bytes, even if a proxy adds Content-Encoding.
+            for chunk in response.raw.stream(_CHUNK_SIZE, decode_content=False):
+                output.write(chunk)
+        with temporary.open("rb") as compressed:
+            # gzip accepts a zero-byte input, but a completed export must contain a frame.
+            if compressed.read(2) != b"\x1f\x8b":
+                raise DownloadError(DOWNLOAD_SYSTEM_ERROR)
+        has_content = False
+        with gzip.open(temporary, "rb") as decoded:
+            while decoded.read(_CHUNK_SIZE):
+                has_content = True
+        if suppress_empty and not has_content:
+            return False
+        os.replace(temporary, destination)
+        return True
+    finally:
+        if temporary is not None:
+            temporary.unlink(missing_ok=True)

{hivekit-0.8.2 → hivekit-0.9.0}/src/cli/http_client.py

@@ -10,6 +10,7 @@ import logging
 import time
 from http import HTTPStatus
 from typing import Any, Callable, Dict, Optional
+from urllib.parse import quote
 
 import requests
 from authlib.integrations.base_client import OAuthError
@@ -21,6 +22,44 @@ from cli.utils.url_utils import get_api_endpoint
 console = Console()
 logger = logging.getLogger("hivekit")
 
+DOWNLOAD_SYSTEM_ERROR = "A system error prevented the download."
+_EXPIRED_CREDENTIALS = "Your credentials have expired. Please run 'hive login' to re-authenticate."
+
+
+class DownloadError(Exception):
+    """An export failure whose message is safe to show to the user."""
+
+
+def _export_error_message(response: requests.Response) -> str:
+    """Recognize known export errors; never display arbitrary upstream diagnostics."""
+    known_errors = {
+        HTTPStatus.BAD_REQUEST: ("Invalid export mode.",),
+        HTTPStatus.FORBIDDEN: (
+            "You do not have permission to download results.",
+            "You do not have access to this experiment.",
+        ),
+        HTTPStatus.NOT_FOUND: ("Experiment not found.",),
+    }
+    allowed = {
+        message.rstrip(".").casefold(): message
+        for message in known_errors.get(response.status_code, ())
+    }
+    if not allowed:
+        return DOWNLOAD_SYSTEM_ERROR
+    try:
+        payload = response.json()
+    except (ValueError, requests.exceptions.RequestException):
+        return DOWNLOAD_SYSTEM_ERROR
+    if isinstance(payload, dict):
+        for field in ("error", "detail"):
+            value = payload.get(field)
+            if isinstance(value, str):
+                key = value.strip().rstrip(".").casefold()
+                message = allowed.get("invalid export mode" if key == "invalid mode" else key)
+                if message is not None:
+                    return message
+    return DOWNLOAD_SYSTEM_ERROR
+
 
 def _http_error_detail(e: requests.exceptions.HTTPError) -> str:
     """Best-effort human-readable detail from an HTTP error.
@@ -153,9 +192,7 @@ class HttpClient:
         try:
             self._session.ensure_active_token(token)
         except OAuthError as e:
-            raise AuthenticationError(
-                "Your credentials have expired. Please run 'hive login' to re-authenticate."
-            ) from e
+            raise AuthenticationError(_EXPIRED_CREDENTIALS) from e
         return self._session.token["access_token"]
 
     def get_push_credentials(self, reference: str) -> Dict[str, Any]:
@@ -411,6 +448,28 @@ class HttpClient:
         )
         return response.json()
 
+    def stream_experiment_export(self, name: str, mode: str = "metadata") -> requests.Response:
+        """Open a Monolith export; the caller owns and must close the response."""
+        if mode not in {"metadata", "source", "evolution-reports"}:
+            raise DownloadError("Invalid export mode.")
+        if not name:
+            raise DownloadError("Experiment name must be non-empty.")
+        try:
+            response = self._stream_get(
+                f"/experiments/{quote(name, safe='')}/contents-export",
+                params={"mode": mode},
+                headers={
+                    "Accept": "application/gzip",
+                    "Accept-Encoding": "identity",
+                },
+            )
+        except requests.exceptions.RequestException:
+            raise DownloadError(DOWNLOAD_SYSTEM_ERROR) from None
+        if response.status_code != HTTPStatus.OK:
+            with response:
+                raise DownloadError(_export_error_message(response))
+        return response
+
     def list_coordinators(self) -> Dict[str, Any]:
         """
         List coordinator configurations.
@@ -443,20 +502,10 @@ class HttpClient:
         Returns a streaming Response object. Caller should iterate with
         response.iter_lines() and close when done.
         """
-        url = f"{self.base_url}/experiments/{name}/logs"
         params = {"source": source, "follow": "true" if follow else "false"}
         if worker is not None:
             params["worker"] = worker
-        headers = self._get_headers()
-
-        response = self._request(
-            method="get",
-            url=url,
-            headers=headers,
-            params=params,
-            stream=True,
-            timeout=None,
-        )
+        response = self._stream_get(f"/experiments/{name}/logs", params=params)
 
         if response.status_code == HTTPStatus.NOT_FOUND:
             raise StreamNotReadyError()
@@ -520,6 +569,19 @@ class HttpClient:
         """
         return {"Content-Type": "application/json"}
 
+    def _stream_get(
+        self, path: str, *, params: dict[str, str], headers: dict[str, str] | None = None
+    ) -> requests.Response:
+        """Open an authenticated stream with no transfer timeout; caller owns the response."""
+        return self._request(
+            method="get",
+            url=f"{self.base_url}{path}",
+            headers=self._get_headers() | (headers or {}),
+            params=params,
+            stream=True,
+            timeout=None,
+        )
+
     def _send(
         self,
         method: str,
@@ -563,77 +625,35 @@ class HttpClient:
         Make an HTTP request, automatically retrying once on 401 by invoking
         the on_auth_failure callback.
         """
-        try:
-            response = self._session.request(
-                method=method,
-                url=url,
-                headers=headers,
-                json=json,
-                params=params,
-                stream=stream,
-                timeout=timeout,
-                verify=not self._insecure,
-            )
-        except OAuthError as e:
-            logger.debug(f"OAuth error during request: {e.error}. Attempting to re-authenticate.")
-            return self._retry_with_reauth(
-                method=method,
-                url=url,
-                headers=headers,
-                json=json,
-                params=params,
-                stream=stream,
-                timeout=timeout,
-            )
-        if response.status_code == HTTPStatus.UNAUTHORIZED:
-            logger.debug("Received 401 response. Attempting to re-authenticate.")
-            return self._retry_with_reauth(
-                method=method,
-                url=url,
-                headers=headers,
-                json=json,
-                params=params,
-                stream=stream,
-                timeout=timeout,
-            )
-        return response
-
-    def _retry_with_reauth(
-        self,
-        method: str,
-        url: str,
-        headers: Dict[str, str],
-        json: Optional[Dict[str, Any]] = None,
-        params: Optional[Dict[str, str]] = None,
-        stream: bool = False,
-        timeout: Optional[int] = 30,
-    ) -> requests.Response:
-        """
-        Attempt re-authentication and retry the failed request.
-        """
-        try:
-            self._session = self._on_auth_failure()
-        except AuthenticationError:
-            raise
-        except Exception as e:
-            raise AuthenticationError(
-                "Your credentials have expired. Please run 'hive login' to re-authenticate."
-            ) from e
-        response = self._session.request(
-            method=method,
-            url=url,
-            headers=headers,
-            json=json,
-            params=params,
-            stream=stream,
-            timeout=timeout,
-            verify=not self._insecure,
-        )
-        if response.status_code == HTTPStatus.UNAUTHORIZED:
-            raise AuthenticationError(
-                "Your credentials have expired. Please run 'hive login' to re-authenticate."
-            )
-        return response
+        for attempt in range(2):
+            try:
+                response = self._session.request(
+                    method=method,
+                    url=url,
+                    headers=headers,
+                    json=json,
+                    params=params,
+                    stream=stream,
+                    timeout=timeout,
+                    verify=not self._insecure,
+                )
+            except OAuthError as error:
+                if attempt:
+                    raise
+                logger.debug("OAuth error during request: %s. Re-authenticating.", error.error)
+            else:
+                if response.status_code != HTTPStatus.UNAUTHORIZED:
+                    return response
+                response.close()
+                if attempt:
+                    raise AuthenticationError(_EXPIRED_CREDENTIALS)
+                logger.debug("Received 401 response. Re-authenticating.")
+            try:
+                self._session = self._on_auth_failure()
+            except AuthenticationError:
+                raise
+            except Exception as error:
+                raise AuthenticationError(_EXPIRED_CREDENTIALS) from error
 
 
 def create_http_client(